Threat actor 'TheHatman' markets millions of Azure employee records from major firms
A cybercriminal known as TheHatman is offering for sale large sets of employee data allegedly stolen from Azure directories of companies such as McDonald's and Vodafone.
Security researchers at Hudson Rock have identified a campaign in which a threat actor using the alias TheHatman advertises for sale employee records purportedly taken from Microsoft Azure tenant directories of nine major corporations. The claimed haul lists McDonald's with 1.7 million records, Tata Consultancy Services with 800,000, Vodafone with 425,000, and additional data from firms such as HCL Technologies, IHG Hotels & Resorts, Kyndryl, Gap, Hexaware Technologies and Wyndham Hotels & Resorts.
Sample files examined contain extensive personal and professional details, including phone numbers, physical addresses, employee IDs, titles, department affiliations and even accounts with Global Administrator privileges. Hudson Rock assesses the data as highly likely genuine based on the consistency of email domains and Azure export formats, though it could not verify how the attacker initially accessed the environments.
Potential vectors include stolen credentials, session cookies, phishing, weak multifactor authentication or overly permissive third-party apps. The affected companies have been asked for comment; Tata Consultancy Services issued a statement saying no credible breach evidence was found and that any referenced data appears outdated and limited to basic employee information.
Why it matters
Exposing large volumes of corporate employee data could enable targeted phishing and other attacks on major enterprises.
In this story
